Emily Traylor, MBA

Calling on my network-- I'm looking for cybersecurity conferences that others find value in attending. I myself will be attending NC TECH State of Technology EXPONENTIAL Conference for the first time next week! So, I want to hear from you! What are your favorite cybersecurity conferences that you find value in attending? Drop your recommendations in the comments below and let's create a resource for the entire community to benefit from! #Cybersecurity #Conferences #Networking #ProfessionalDevelopment

2

Joseph Goodman, by Steven Palange and Copilot for Microsoft 365, Certainly! Here’s a rewritten “About Me” section and a detailed cybersecurity plan: About Me: With a robust 25-year trajectory in IT, I’ve navigated roles from help desk support to security and compliance leadership at Virginia Tech. My expertise spans across platforms, with a niche in PHP and MySQL for web app development1. Presently, I’m steering IT security and compliance, safeguarding sensitive data across financial, student, and medical domains, and adhering to standards like PCI-DSS and HIPAA2. My tenure in public service as a council member in Pulaski, Virginia, has honed my skills in budgeting, economic development, and fostering collaborative governance. Cybersecurity Plan: Risk Assessment: Conduct a comprehensive risk assessment to identify potential cybersecurity threats. Evaluate the effectiveness of current security measures and identify areas of improvement. Policy Development: Develop clear cybersecurity policies and procedures, including incident response and disaster recovery plans. Ensure policies meet compliance standards like PCI-DSS, FERPA, HIPAA, GDPR, and GLBA2. Employee Training: Implement ongoing cybersecurity awareness training for all employees. Simulate phishing and social engineering attacks to prepare staff for real-world scenarios. Infrastructure Security: Deploy advanced firewalls, intrusion detection systems, and endpoint protection solutions. Regularly update and patch systems to protect against known vulnerabilities. Data Protection: Encrypt sensitive data both in transit and at rest. Establish strict access controls and regularly review permissions. Monitoring and Response: Utilize SIEM tools for real-time monitoring and alerting of potential security incidents. Develop a structured incident response team ready to act on alerts swiftly. Vendor Management: Assess the security posture of all third-party vendors. Ensure vendors adhere to the same ethical and security standards as the company. Continuous Improvement: Regularly review and update the cybersecurity plan to adapt to new threats and technologies. Foster a security culture within the organization, encouraging proactive identification and reporting of security issues. This plan leverages AI capabilities to enhance threat detection, automate security tasks, and provide predictive analytics for proactive defense strategies. It’s designed to be dynamic, adapting to the evolving landscape of cybersecurity threats.

43

It was pretty neat to see media coverage of our cybersecurity panel discussion at the North Carolina Technology Association (NC TECH) State of Technology event yesterday. Thank you Shane Snider and InformationWeek!! A few key highlights: 1. Remember the basics - While new threats come out all the time, don't forget the fundamental protective measures to secure your organization 2. Minimize Data - In addition to assessing your third-parties and adding security contract language, minimize data with them to the least amount necessary to complete the task. 3. AI for Good - Yes, criminals can use AI, but the defenders can too! 4. MFA - Please use Multi-factor Authentication (MFA) whenever possible. #cybersecurity #news #securetheplanet

121

7 Comments

If you don’t have an incident response plan, now is the time to develop one. Being prepared to tackle a cyber incident helps minimize damage and get your organization back up and running as quickly as possible. Need help developing a robust incident response plan? Feel free to reach out to us.

1

At Data Connectors Dallas on Thursday, May 16, 2024, at 1:30 PM, dive deep into the practicalities of risk assessments with me as we explore "How to Operationalize Your Risk Assessments." With new SEC regulations reshaping the landscape, understanding how to effectively implement risk assessment processes within your organization is more critical than ever. This session will offer step-by-step guidance on converting risk assessments from a theoretical exercise into a practical tool that drives business outcomes. We will tackle the complexities of meeting and exceeding the latest SEC disclosure requirements and provide actionable insights into operationalizing your risk assessments. Learn how to tailor your risk assessment strategy to fit the unique needs of your organization, ensuring that every component of your risk management is as robust as it is relevant. By the end of this session, you will be equipped with the knowledge to empower your team with essential insights and tools that not only comply with regulations but also pave the way for informed decision-making and enhanced organizational resilience. #cybersecurity #risk #events

2

1 Comment

"Ticketmaster and multiple other organizations have had significant amounts of information stolen in a data breach at cloud storage company Snowflake, security researchers report. The theft of Ticketmaster data came to light last week, when a notorious hacking group claimed to have exfiltrated the information of 560 million users, asking $500,000 for the data. In an SEC filing late last week, Ticketmaster parent company Live Nation Entertainment confirmed unauthorized access to “a third-party cloud database environment” mainly containing data from the online ticket sales platform. “On May 27, 2024, a criminal threat actor offered what it alleged to be company user data for sale via the dark web. We are working to mitigate risk to our users and the company, and have notified and are cooperating with law enforcement,” the filing reads. While Live Nation Entertainment does not name the third-party services provider responsible for the breach, the threat intelligence community has learned that it’s Snowflake, a cloud AI data platform that thousands of companies use for storing, managing, and analyzing large volumes of data." #cybersecurity #breach

1

I see TAs looping over wevtutil and deleting event logs on any.run and various reports. Why? Anyone wants to fill me in - please let me know. I get the action is defense evasion. Most orgs send logs to a SIEM. Are they catching and deleting the logs prior to the SIEM push? Let me know. #cybersecurity

1

🎤 Friendly PSA: make sure your app doesn't send reset password emails to unverified email addresses. 📨 "Tracked as CVE-2023-7028 (CVSS score: 10.0), the maximum severity vulnerability could facilitate account takeover by sending password reset emails to an unverified email address." 🧠 This is also a good reminder to turn on that MFA for your accounts. As GitLab states: "Additionally, users who have two-factor authentication enabled are vulnerable to password reset but not account takeover as their second authentication factor is required to login." https://lnkd.in/gAv5WKkj #hack #mfa #cisa #passwords #security #auth #wristband

8

How to lessen the impact of complying with DFARS CUI requirements (DFARS 252.204.7012) or the CMMC program assessment you may be required to meet. Yes, the costs will be high esp. for an SMB. The answer is a business answer and not a cybersecurity answer at all. When I study P&L statements and balance sheets with my financial review team (these days that means by myself :p), I see large expenses that are spread out across months and quarters. This is how to avoid that large lump payment that hurts. The same for the DFARS and CMMC preparations. Spread out your workload across 12-18 months. Pay for services as you need them in small affordable amounts. For example, make a $30k CMMC preparation a $1600/Month expense over 18 months. There is another secret benefit to this approach - most compliance experts will tell you that it takes that long anyway if you are to truly implement a proper and passable cybersecurity program. So many of the answers to managing a cybersecurity program can be found in the daily business practices you already are doing. I have been studying how to lessen the burden on SMB's to achieve compliance and have some controversial ideas that I have been slowly unwinding here. They include: 1. [Executive Leadership] CEO emotional intelligence (EQ) - no this is not an attack but a concept for executive leadership if you have read anything about it [Subtopic Executive Coaching] 2. [Team Building] Team Transparency and commitment. 3. [Project Management] Use of tools like OKR's to keep the 18-month program on track and accountable to each other (another sign of EQ). Trust is good but verification is better. 4. [IT Planning and Management] Putting together the right mix of tools (yes you might choose to buy some software for parts of this) that will help you cover a majority of the security controls and requirements without overlap. 5. [Board Room Discussion] Consideration of your IT architecture and migrations to platforms that will ease the compliance burden. 6. [HR} Find a compliance SME that your team can work with over the 18 months and beyond. Get the right consultant on the bus and get the wrong consultant off the bus. Food for thought. #CW #ceomindset #CMMC #cybersecurity #DFARS

2

1 Comment

Fundamentals… Per the The Wall Street Journal, signs lead to the attachers who attacked UHC‘s Change Healthcare were dwelling for nine days before releasing their ransomware strike. The attackers used compromised credentials on remote access systems and multifactor authentication wasn't enabled on that particular application. It comes down to visibility and MFA… Let this serve as a reminder just how damn hard it is getting the cybersecurity blocking and tackling right, yet we continue to be enamored by the latest ML/AI thingamagig. Can AI help with fundamentals? Absolutely, but it needs to be intentional and planned and part of your strategy. #cybersecurity #CISO #leadership

17

1 Comment

The recent data theft incident at Ticketmaster has raised concerns among 560 million users, with a hacking group demanding $500,000 for the compromised data. Live Nation Entertainment, Ticketmaster's parent company, confirmed unauthorized access to a third-party cloud database in an SEC filing last week. For Snowflake customers, the SEC's new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, effective from July 26, 2023, emphasizes the need for organizations to provide transparent information on how they handle cyber risks. Stay vigilant and prioritize cybersecurity measures to safeguard sensitive data in an increasingly digital landscape. #Cybersecurity #DataPrivacy #SEC #IncidentResponse #isaca #itaudit

4

1 Comment

Thank you to our friends at Akamai Technologies for supporting this session coming up next Thursday, during the Atlanta CISO Executive Summit. We are looking forward to this Executive Boardroom as Sean Flynn, CISSP, CFE and Ravi Pentapaty discuss "From Z to A - Extending Zero Trust to APIs" As more and more organizations adopt a Zero Trust architecture (ZTA), many initiatives overlook the increased prevalence of API-based access to sensitive application functionality and data. As CISOs move forward in their ZTA journey, how can they extend these principles to their API strategy to ensure security from the network layer to the application layer? Join this session to discuss: 💥 Breaking the kill chain by stopping infection vectors and protecting against lateral movement 💥 Shielding sensitive data and limiting how APIs interact with data 💥 Increasing real-time visibility across the business to mitigate threats Their is still time to register! If you would like more information on this gathering or information on becoming a member of the Atlanta CISO community (complimentary to qualified executives), reach out to kimberly.lewis@evanta.com #AtlantaCISO #CISO #Evanta #Gartner

18

CMMC compliance is crucial for organizations in the Defense Industrial Base. Delaying readiness for CMMC not only increases costs but also forces organizations to choose fast over cheap, as the Department of Defense has already prioritized quality. Procrastination in preparing for CMMC compliance is not a winning strategy and can significantly impact an organization financially. See this post… 💰 🐢 📈 📊 🐢 💰 🛑

2

Headed to RSA Conference? Here are a few tips from someone who has been there ~22 times, (but who is counting?!) In addition to the big vendors who often host informational talks at their booths, make time to visit the small booths on the expo floor. You will see cool, new technology; meet interesting people; and the vibe is less intense. Go to the sessions that interest you the most and turn on your active listening skills. Your texts and emails can wait. The speakers spend months preparing high quality, compelling content. They deserve our attention and informed Q&A. Help the new folks with directions, tips, and advice they seek. We were all new once. Network. Make it a goal to meet 5 new people and build a plan to stay connected to them. Rest. It is a marathon, not a sprint. There are a lot of competing events and demands on your time. Make sure you take time every day to recharge and rehydrate. Create a buddy system for your safety. Prioritize rest and safety. Have fun. RSA week is one of the coolest weeks of the year. It can be as entertaining and compelling as you make it. The opportunity for engaging conversations, deep topic discussions, forging new friendships, and building industry depth is unsurpassed. Hope to see you there!

586

39 Comments

I'm reading the "2024 Report on the Cybersecurity Posture of the United States". It covers the recent steps taken to protect our nation's well-being. One line that resonated with me is "Shaping market forces to place responsibility on those entities best positioned to reduce risk and forging a more trustworthy digital ecosystem". Cloud service providers often discuss shared responsibility. The CSP is responsible for X, Y, and Z, while the customer is responsible for A, B, and C. In many cases, the customer must correctly configure and set up their cloud application or service to meet their responsibilities. This can lead to situations where the customer never sets things up appropriately. It could be due to oversight, skills gap, UX concerns, or perceived lack of benefit. How do we shift that responsibility a little to the left? Instead of giving customers the option to have improved security, turn it on by default, or make it non-optional. Organizations with the skills and expertise should help move the industry forward by forcing and normalizing more of these best practices. https://lnkd.in/g4pXHHF4

23

1 Comment

Several great demos this week showing how to navigate the CISA Secure Software Attestation process using the CISA RSAA portal. Two more demos are scheduled for next week. The date when US Government Agencies will begin collecting these attestations is right around the corner, starting June 8, 2024. Software vendors really should begin preparations ASAP to submit their CISA Secure Software Attestation Forms and other artifacts, like SBOM's, POA&Ms, Vulnerability Disclosure Reports (VDR) and Vendor Response Forms (VRF) in the RSAA portal. Reliable Energy Analytics LLC organizes its CISA attestation submittal package using the open-source vendor response form (VRF) that was demonstrated by the IETF SCITT Hackathon in July 2023. https://lnkd.in/ebwVHr8v There are many unanswered questions, using solely the Secure Software Attestation Form, that government officials will want to know answers to when evaluating software products submitted to the RSAA portal. Here are a few of the items that are missing, which are addressed in the Vendor Response Form: - Is the software producer foreign owned? - Does the product contain foreign technology that may be prohibited by the US Government? - Is the product currently supported? - What is the commercial status of hte product; is it end of life? - What requirements within the secure software attestation form is the software producer unable to attest to and require a POA&M? These are just a few of the items that federal officials will be considering when they evaluate a software product as part of the CISA secure software attestation form evaluation process that will require the additional information provided in a Vendor Response Form (VRF), POA&M, SBOM and VDR artifacts that software producers should consider uploading to the CISA RSAA portal along with their attestation forms to eliminate the "back-forth" questioning that can occur when a attestation form alone is uploaded to the CISA RSAA portal. It is in the software producers best interest to supply this additional material/artifacts, up front with the attestation form in order to ensure efficient processing and approval of their products under the OMB M-22-18 Software Attestation and evaluation process. An open source VRF template is available here to help software vendors prepare to "pass the attestation form test'; https://lnkd.in/eQq5JXHa

3